Data Processing Addendum, version 1.1

This Data Processing Addendum ("DPA") is part of the agreement between Harnace LLC, a Wyoming limited liability company ("Harnace"), and the Customer that accepted the Terms of Service or signed an Order Form (the "Agreement"). It applies whenever Harnace processes Customer Personal Data in providing the Service. Words defined in the Terms of Service mean the same here.

1. Definitions

1.1 "Data Protection Laws" means the laws that apply to the processing of Customer Personal Data under the Agreement, including, where they apply, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection and the California Consumer Privacy Act as amended by the California Privacy Rights Act, with its regulations ("CCPA").

1.2 "Customer Personal Data" means personal data within Customer Data that Harnace processes on the Customer's behalf.

1.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.

1.4 "Subprocessor" means a third party Harnace engages to process Customer Personal Data.

1.5 "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0, in force from 21 March 2022.

1.6 "Controller", "processor", "data subject", "personal data", "processing", "supervisory authority", "business", "service provider", "sell" and "share" have the meanings Data Protection Laws give them.

2. Roles

2.1 For Customer Personal Data, the Customer is the controller, or a processor acting for its own controllers, and Harnace is the Customer's processor, or subprocessor where the Customer is itself a processor.

2.2 Under the CCPA, the Customer is a business and Harnace is its service provider.

2.3 Harnace is a controller only of the personal data it processes to run its own business, such as account sign-in details, billing contacts and Usage Data. Its Privacy Policy at https://harnace.com/privacy covers that data, and this DPA does not.

3. Instructions

3.1 Harnace processes Customer Personal Data only on the Customer's documented instructions. The Agreement, the Customer's configuration of the Service and the Customer's use of it, including the systems it connects, the files it drops, the definitions it approves and the AI Clients its Users connect, are those instructions.

3.2 Harnace will tell the Customer if, in its opinion, an instruction breaks Data Protection Laws, and may suspend the processing it concerns until the Customer confirms or changes it.

3.3 The Customer is responsible for the lawfulness of the instructions it gives and of the Customer Personal Data it provides, and for giving any notice and getting any consent Data Protection Laws require.

3.4 When a User connects an AI Client, Harnace sends Customer Data to that AI Client on the Customer's instruction. The AI Client and its AI Provider are the Customer's own recipients under the Customer's own agreement with that provider, not Harnace's Subprocessors, and this DPA does not govern what they do with what they receive.

4. CCPA service provider terms

4.1 Harnace will not sell or share Customer Personal Data.

4.2 Harnace will not retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Agreement, including for any commercial purpose other than providing the Service, or outside the direct business relationship between Harnace and the Customer.

4.3 Harnace will not combine Customer Personal Data with personal data it receives from or on behalf of anyone else, or collects from its own interactions with a consumer, except as the CCPA permits a service provider to do.

4.4 Harnace will comply with the CCPA's obligations that apply to it, give Customer Personal Data the level of privacy protection the CCPA requires and tell the Customer if it decides it can no longer meet them. The Customer may then take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data.

4.5 Harnace certifies that it understands and will comply with the restrictions in this section 4.

5. Harnace's people

5.1 Harnace limits access to Customer Personal Data to the personnel who need it to provide the Service, and makes sure each is bound by a duty of confidentiality. Today they are Harnace's two founders.

6. Security

6.1 Harnace will keep in place the technical and organizational measures in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches and to give a level of security appropriate to the risk.

6.2 Harnace may update those measures as technology and threats change, but will not materially reduce the overall security of the Service.

7. Subprocessors

7.1 The Customer gives Harnace general authorization to engage Subprocessors. The current list is in Annex III and on the public page at https://harnace.com/subprocessors.

7.2 Harnace will bind each Subprocessor by a written agreement with data protection obligations no less protective than this DPA, to the extent they apply to the service the Subprocessor provides, and remains responsible to the Customer for each Subprocessor's performance.

7.3 Harnace will update https://harnace.com/subprocessors and email the Customer at least 30 days before a new Subprocessor processes Customer Personal Data.

7.4 The Customer may object to a new Subprocessor on reasonable data protection grounds by emailing hello@harnace.com within that 30 days. The parties will then discuss it in good faith. If Harnace cannot reasonably avoid using the new Subprocessor for the Customer, the Customer may end the affected part of the Agreement by notice, and Harnace will refund any fees prepaid for the time after it ends. This is the Customer's only remedy for an objection.

7.5 Descope Inc. processes Customer Personal Data as Harnace's identity Subprocessor under its own data processing terms at https://www.descope.com/customer-data-processing-amendment.

8. Personal Data Breaches

8.1 Harnace will notify the Customer of a Personal Data Breach without undue delay, and in any case within 72 hours after becoming aware of it.

8.2 The notice will describe, as far as Harnace then knows, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, its likely consequences and the steps taken or proposed to address it. Harnace will add what it learns as it learns it.

8.3 Harnace will take reasonable steps to contain, investigate and remedy the breach, and will help the Customer meet its own duties to notify supervisory authorities and data subjects.

8.4 A notice of a Personal Data Breach is not an admission of fault or liability.

9. Deletion and return

9.1 When the Agreement ends, or when the Customer asks, Harnace will delete Customer Personal Data within 30 days, and confirm in writing. Before deleting, and on the Customer's request made within that period, Harnace will return it as an export of files.

9.2 Two records the Service keeps are chained by cryptographic hashes: the record of what Harnace did and the read ledger. On deletion their contents are deleted with everything else. Harnace keeps each entry's sequence number and hash, which contain no Customer Personal Data, so the chains can still be checked against a hash the Customer kept.

9.3 Backups containing deleted data are overwritten within seven days after deletion.

9.4 Harnace may keep Customer Personal Data where the law requires it, and then only for as long and as narrowly as it requires, protected under this DPA.

10. Help with requests, assessments and authorities

10.1 Harnace will tell the Customer promptly if it receives a request from a data subject about Customer Personal Data, and will not answer it except to direct the data subject to the Customer, unless the law requires otherwise.

10.2 Taking into account the nature of the processing, Harnace will help the Customer, by appropriate technical and organizational measures, to answer data subject requests to access, correct, delete, restrict, port or object to the processing of their personal data, within the time Data Protection Laws allow.

10.3 Harnace will give the Customer the information it reasonably needs for a data protection impact assessment or a prior consultation with a supervisory authority about the Service.

10.4 If a government or regulator asks Harnace for Customer Personal Data, Harnace will tell the Customer before disclosing it, unless the law forbids, and will disclose only what it is legally required to.

11. Audits

11.1 Harnace will make available to the Customer the information reasonably needed to show that it meets this DPA. It does so by report: once a year, on request, Harnace answers the Customer's reasonable security questionnaire and shares its current threat model, a description of its measures in Annex II and its Subprocessors' audit reports where they allow Harnace to share them.

11.2 If that information is not enough to meet a requirement of Data Protection Laws, or a supervisory authority requires it, the Customer may, at its own cost, audit Harnace's compliance with this DPA no more than once a year, on 30 days' written notice, during business hours, through an auditor bound by confidentiality who is not a competitor of Harnace and in a way that does not reach other customers' data or unreasonably disrupt the Service.

12. International transfers

12.1 Harnace stores and processes Customer Personal Data in the United States.

12.2 Where Customer Personal Data subject to the GDPR is transferred to Harnace in a country the European Commission has not found adequate, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor.
• The Customer is the data exporter and Harnace is the data importer.
• Clause 7, the docking clause, applies.
• In Clause 9, Option 2 (general written authorization) applies, with the 30 days' notice in section 7.3.
• In Clause 11, the optional language does not apply.
• In Clause 13, the competent supervisory authority is the one that applies under Clause 13 given the Customer's establishment or representative.
• In Clause 17, Option 1 applies, and the law of Ireland governs.
• In Clause 18, the courts of Ireland have jurisdiction.
• Annex I of the SCCs is completed by Annex I of this DPA, Annex II by Annex II and Annex III by Annex III.

12.3 Where Customer Personal Data subject to the UK GDPR is transferred, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. Table 1 is completed with the parties' details in Annex I, Table 2 with the Modules and options in section 12.2, Table 3 with the Annexes of this DPA and, in Table 4, either party may end the UK Addendum as its Section 19 allows.

12.4 Where Customer Personal Data subject to the Swiss Federal Act on Data Protection is transferred, the SCCs apply with these changes: references to the GDPR mean that Act, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland, so that data subjects in Switzerland may bring claims in their place of habitual residence.

12.5 If the SCCs or the UK Addendum conflict with this DPA or the Agreement, the SCCs or the UK Addendum win.

13. Liability and precedence

13.1 Each party's liability under this DPA is subject to the limitations in section 14 of the Terms of Service, except where Data Protection Laws or the SCCs do not allow that liability to be limited, including liability to data subjects under the SCCs.

13.2 This DPA wins over the rest of the Agreement for the processing of Customer Personal Data. It lasts as long as Harnace processes Customer Personal Data.

Annex I. Description of the processing

A. The parties

Data exporter: the Customer, as named in its account or Order Form, contact through the email address of its account's owner. Role: controller, or processor for its own controllers.

Data importer: Harnace LLC, a Wyoming limited liability company, contact hello@harnace.com. Role: processor, or subprocessor.

Each party signs Annex I by accepting the Terms of Service in the console or signing an Order Form.

B. The transfer

Categories of data subjects: the Customer's Users and personnel, and the people named in the records of the Customer Systems it connects and the files it drops, such as its customers' and vendors' contacts and its own staff.

Categories of personal data: names, work email addresses, job titles and roles, what each User may see, sign-in records, the AI clients each User connected and what they asked, business contact details in invoices, contracts and CRM records, the commercial terms tied to them and, only where the Customer uses commission statements, what a person is paid.

Sensitive data: none is intended. The Customer will not provide special categories of personal data, government identifiers, payment card numbers, bank account numbers or health information. The Service cuts bank account, routing and payment card numbers from a dropped file before it is kept: in a spreadsheet or CSV it empties each column that reads as one, and any cell that shows one, keeping the column's name, and it empties a column that reads as a government identifier the same way. A PDF or other document that shows such a number is refused and not kept, and a scanned page, which can be checked only once it is read, is deleted when it is. The hash of the file as sent is kept, so the record of what arrived still holds.

Frequency: continuous, for as long as the Agreement lasts.

Nature of the processing: reading the Customer Systems the Customer connects, read only. Checking, storing, versioning and organizing records. Computing figures, definitions and differences. Serving them to the Customer's Users and AI Clients. Logging every read.

Purpose: to provide the Service to the Customer under the Agreement.

Retention: for the life of the Customer's account, with up to 36 months of history read from each system when it is connected, and deletion as section 9 says.

Transfers to Subprocessors: for the subject, nature and duration in Annex III.

C. Competent supervisory authority

As section 12.2 says.

Annex II. Technical and organizational measures

Encryption

• All traffic to and from the Service, and between the Service and its database, is encrypted in transit with TLS.
• Customer Data is encrypted at rest by the database host.
• Credentials for Customer Systems are sealed again with AES-256-GCM under a key kept outside the database, are never shown to an AI model and are deleted when the Customer disconnects.

Separation between customers

• Every table that holds Customer Data carries the customer's id, and the database enforces row-level security on every such table, with row-level security forced so that it binds the table's owner too.
• The application connects as a role that can see only the customer whose request it is serving.
• An automated isolation proof and tests check that nothing written as one customer can be read as another, and a test fails the build if a table holding Customer Data lacks the policy.

Least privilege

• The application's database role cannot delete from the audit records, change the read ledger, turn a customer's endpoint on or record an agreement.
• Production systems and Customer Data are reachable only by Harnace's two founders.
• Harnace asks each Customer System for the narrowest read access it offers, and the Service's code refuses any request that would change a record. A test fails the build if any connector could send a write.

Authentication and access

• Users sign in without passwords, with a one-time code or link that expires after 15 minutes, works once and locks after five wrong tries. The one password sign-in is a reviewer account Harnace gives an AI directory's reviewer, which reads only an invented company and never Customer Data.
• An AI Client connects through OAuth with PKCE, through Descope. Its token is tied to one User, one client and one company, is checked on every request and can be revoked one connection at a time.
• Each connection is rate limited, and the Service caps its own daily spend on AI models.

Logging and audit

• Every action the Service takes, and every read an AI Client makes, is recorded on a ledger in which each entry carries a hash of the one before, so a changed or removed entry breaks the chain.
• The read ledger records who asked, through which client, which tool, the request and how many rows and fields came back, never the answer itself.
• The Customer's leaders can see the read ledger and whether its chain holds, and can export the record.

Keys

• The sealing key can be rotated by a documented procedure that re-seals every credential under the new key.
• Keys are rotated at once if a compromise is suspected, and when someone with access to them leaves.

Resilience

• The database is backed up daily, and backups are kept for seven days.
• Customer Data is stored in the United States.

Handling what the Customer sends

• Documents, emails and records are treated as data and never as instructions to the Service.
• Text from a document is read by a step with no tools, so it cannot cause an action.

People and vendors

• Everyone with access is bound by confidentiality.
• Every Subprocessor is bound by data protection terms as section 7 says.

Incidents

• Failures and security events alert the founders, and Personal Data Breaches are handled as section 8 says.

Annex III. Subprocessors, as of October 14, 2026

• Vercel Inc. (Vercel): hosts the site and runs the application. United States (Portland, Oregon). Always.
• Supabase Inc. (Supabase): the database, file storage and daily backups. United States (Oregon). Always.
• Descope Inc. (Descope): sign-in and authorization when a customer's AI connects. United States. When a user connects an AI to Harnace.
• Anthropic, PBC (Anthropic): the AI model Harnace uses inside the service: to read files a customer drops or emails in, sort mail sent to a company's inbox, answer questions asked in the console, in Slack or by voice, and match and map the records a company connects to build its outputs. The figures an AI reads through the endpoint are computed by Harnace's code, not by this model. United States. Always.
• ActiveCampaign, LLC (Postmark): sends Harnace's email, including sign-in codes, and receives mail sent to a company's inbox. United States. Always.
• PostHog, Inc. (PostHog): product analytics and session recordings, on the public site and in the console. United States. Always.
• Slack Technologies, LLC (Slack): messages to and from Harnace in a customer's workspace, and Harnace's own alerts to its founders about an account. United States. A customer's workspace only when the customer adds Harnace to it. Harnace's own alerts always.
• GitHub, Inc. (GitHub): holds Harnace's code, and the settings of a company Harnace set up by hand before sign-up opened. United States. Only for a company Harnace set up by hand.
• Vapi (Vapi): voice calls with Harnace, with Deepgram turning speech into text for Vapi. United States. Only when someone talks to Harnace by voice.

The current list is at https://harnace.com/subprocessors.